Description
Unspecified vulnerability in Mozilla Firefox before 1.5.0.8, Thunderbird before 1.5.0.8, and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary code via the XML.prototype.hasOwnProperty JavaScript function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | firefox-esr | 45.0esr-1 | — |
| Debian 13 | firefox-esr | 45.0esr-1 | — |
| Debian 12 | firefox-esr | 45.0esr-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | devhelp +1 | 0.10-0.5.el4 | RHSA-2006:0734 |
| RHEL 4 | firefox +1 | 1.5.0.8-0.1.el4 | RHSA-2006:0735, RHSA-2006:0733 |
| RHEL 4 | seamonkey +5 | 1.0.6-0.1.el4 | RHSA-2006:0734 |
| RHEL 3 | seamonkey +9 | 1.0.6-0.1.el3 | RHSA-2006:0734 |
| RHEL 2 | seamonkey +9 | 1.0.6-0.1.el2 | RHSA-2006:0734 |
Advisories 3
- RHSA-2006:0734 Red Hat Security Advisory: seamonkey security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0735 Red Hat Security Advisory: thunderbird security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2006:0733 Red Hat Security Advisory: firefox security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- https://bugzilla.mozilla.org/show_bug.cgi?id=355569
- ADV-2006-3748 vdb-entry
- 1017178 vdb-entry
- 1017179 vdb-entry
- GLSA-200612-08 vendor-advisory
- 23013 third-party-advisory
- http://support.avaya.com/elmodocs2/security/ASA-2006-246.htm
- http://www.mozilla.org/security/announce/2006/mfsa2006-65.html
- 20061109 rPSA-2006-0206-1 firefox thunderbird mailing-list
- 22770 third-party-advisory
- ADV-2006-4387 vdb-entry
- mozilla-xmlprototypehasownproperty-dos(30093) vdb-entry
- https://issues.rpath.com/browse/RPL-765
- 23009 third-party-advisory
- TA06-312A third-party-advisory
- 22980 third-party-advisory
- RHSA-2006:0733 vendor-advisory
- 24711 third-party-advisory
- 23263 third-party-advisory
- 22763 third-party-advisory
- 22965 third-party-advisory
- USN-382-1 vendor-advisory
- 1017177 vdb-entry
- ADV-2008-0083 vdb-entry
- RHSA-2006:0735 vendor-advisory
- SUSE-SA:2006:068 vendor-advisory
- GLSA-200612-07 vendor-advisory
- VU#815432 third-party-advisory
- ADV-2007-1198 vdb-entry
- 23297 third-party-advisory
- 22727 third-party-advisory
- 22815 third-party-advisory
- RHSA-2006:0734 vendor-advisory
- SSRT061181 vendor-advisory
- 22737 third-party-advisory
- 22929 third-party-advisory
- GLSA-200612-06 vendor-advisory
- MDKSA-2006:206 vendor-advisory
- 20957 vdb-entry
- 22066 third-party-advisory
- 22774 third-party-advisory
- oval:org.mitre.oval:def:11496 vdb-entry signature
- 22817 third-party-advisory
- 22722 third-party-advisory
- MDKSA-2006:205 vendor-advisory
- 23287 third-party-advisory
- USN-381-1 vendor-advisory